Maybe someone who has dealt with this issue may be able to offer some ideas.
I was asked by management to create an alert to run every two hours (will change that soon to maybe once a day) and the alert works as described. Emails me information about each access port that has more than one mac address. I get one email for each instance of this condition every time the alert runs.
At this point a lot if not all ports (50 ports/alerts) are allowed to have more than one mac. Therefore, I tried to filter out the allowed ones from the alert but it looks like it's not possible. A couple of things I have done: 1) put a comment on the port itself within Solarwinds 'MultiMacAllowed', 2) I created a custom Interface property, 'MultiMacAllowed' and marked it as such, but later found out that I can't filter/use these fields in the alert trigger conditions. So that route was not going to work.
After looking at the trigger condition options which there are not many ('description', 'endpoint count','Name','NodeID',PortID'), I figured maybe I can use the 'description field' for this purpose. Not sure what 'description' really means, but I assumed it mean port description on the switch. Configured the port description on our Cisco switch with 'MutliMacAllowed' as the descriptions and tried again using that field. No luck here either. No matter how I set it up it did not filter at all. If I run just the Endpoint count >= to 2, I got 50 triggered objects. If/when I added the 'description' options no matter how I configured it I got zero triggered object. Next idea was to use the PortID as the filter. Found out the exact PortID for some of the ports I don't want to alert on and configured the condition as : PortID is not equal to xxx (tried other options) and still got 50 triggered objects. So PortID option is not working and it's ignored. Just to see if this thing even works, I used the NodeID field. Found the nodeID for a specific switch in question and said, "NodeID' not equal to xxx" and it worked. When I ran the alert it only alerted on all switch ports except on ports on the switches that I told it to not alert. But this option is no help either as I don't want it to omit the whole switch from the alerts.
Does anyone have any ideas why it doesn't work with 'description' and PortID, but works with NodeID? Or maybe someone figured out a different way of accomplishing the same thing. Any ideas/suggestions would be greatly appreciated. At this point I spent more than 3 days working on this and got nowhere. Tried using reports vs alerts and didn't get far. Even tried Report Write directly on the server and got nowhere fast.
